Privacy Policy

WrapInbox (“WrapInbox,” “we,” “us,” or “our”) is a business-to-business (B2B) software-as-a-service platform, built by Electrobtech Innovations Pvt Ltd, that helps organizations (“Customers,” “you,” or “your organization”) capture, qualify, and engage leads and contacts across channels such as WhatsApp, Instagram, Messenger, SMS, webchat, voice, email, Google Business Profile, and LinkedIn, and manage related CRM, marketing, billing, and analytics workflows.

This Policy covers two categories of people whose information we process, and treats them differently:

• Customer users — the people at your organization who sign up for, are invited to, and use WrapInbox (account owners, admins, managers, sales/support/marketing staff).
• End customers / contacts — the leads, contacts, and message senders that your organization manages inside WrapInbox (e.g. a WhatsApp customer messaging your business). For this category, your organization is the data controller and WrapInbox acts as a data processor / service provider on your instructions. If you are an end customer of one of our business Customers and have questions about your data, please contact that business directly; we will support their requests to us as required by law and by our agreement with them.

Google data we access, and why

We access Google data only after you connect your Google account and approve the permissions (“scopes”) on Google's consent screen. Depending on which features you enable, these can include:

How we use Google user data

We use Google user data strictly to provide the user-facing features you requested:

• real-time notification, triage and qualification of customer leads and reviews;
• syncing authorized lead conversations into your connected CRM or unified inbox;
• generating draft responses to customer reviews and enquiries with our AI agents, when you configure them to do so.

What we never do with Google user data

• We do not use Google user data to develop, improve or train generalized AI/ML models. Where content is sent to a third-party AI provider (see Section 6), it is only to generate the response or summary you asked for within your workspace.
• We do not sell, lease or trade Google user data to third parties, advertising networks, data brokers or aggregators.
• We do not use Google user data to serve advertisements, including retargeting or interest-based advertising.
• We do not allow humans to read Google user data unless you give explicit consent for specific messages, it is necessary for security purposes (such as investigating abuse), or it is required to comply with applicable law.

Storage, security and retention

• Google OAuth tokens are encrypted at rest with AES-256-GCM, and data is transmitted over TLS.
• Each organization's data is isolated from other organizations (database row-level security) and access is controlled by role and authenticated sessions.
• We keep Google user data only while your account remains active and the Google account stays connected, or until you delete it, subject to the retention rules in Section 13.

Revoking access and deleting your data

• Revoke access: you can remove Wrapinbox's access to your Google account at any time at Google Security Settings, or disconnect the Google integration inside Wrapinbox.
• Delete your data: email [email protected] to request deletion of your account and all synced Google data. We will act on verified requests within a reasonable time.

Data we access via LinkedIn, and why

We access LinkedIn data only after a member of your team connects their LinkedIn account and approves the permissions (“scopes”) on LinkedIn's consent screen. Which scopes are requested depends on which LinkedIn features are enabled for your workspace and approved for our app:

How we use LinkedIn data

LinkedIn data is used only to provide the features your organization directs, namely:

• Linking the connecting team member's LinkedIn account to your workspace.
• Publishing posts to the member profile or the LinkedIn Company Page you select.
• Showing comments and reactions on posts published through WrapInbox, and letting you reply or react.
• Creating ad campaigns and showing their performance, where Advertising features are enabled.
• Delivering leads captured through your LinkedIn Lead Gen Forms into your CRM inbox.
• Reporting the conversion events you choose to send back to LinkedIn.

For lead data from Lead Gen Forms, your organization is the data controller and WrapInbox is a processor acting on your instructions (see Section 4). We use it only to deliver it to you and operate the features you use.

What we do not do with LinkedIn data

• No sale or resale. We do not sell, rent, license, broker, or trade LinkedIn data or member information to any third party, data broker, or ad network.
• No scraping. We access LinkedIn only through its official, documented API endpoints under scopes the member has granted. We do not scrape, crawl, or collect member data from LinkedIn pages.
• No unofficial automation. We do not use reverse-engineered or private endpoints, or automated messaging or connection bots.
• No cross-customer access. LinkedIn tokens, page and ad-account mappings, and lead records are scoped to the workspace and user that connected them. Every request that reads or writes them is keyed by that workspace and user, so one organization cannot access another's LinkedIn connection.
• No use beyond what you directed. We do not use LinkedIn data to build profiles of members, for advertising unrelated to your campaigns, or for any purpose LinkedIn's terms do not permit.

Storage and security of LinkedIn data

LinkedIn access tokens, refresh tokens, and the data described above are stored in our database, transmitted over TLS, and protected by the access controls in Section 14. Access is limited to the connected user's workspace and to the staff who operate the service. We refresh access tokens automatically before they expire so that you do not have to reconnect, and mark a connection as needing attention if LinkedIn refuses a refresh.

Retention and deletion of LinkedIn data

• Tokens and connection: kept only while the LinkedIn connection is active. If an access token expires and cannot be refreshed, the connection is marked as expired and you will be asked to reconnect.
• Disconnecting: when you disconnect LinkedIn in WrapInbox, we ask LinkedIn to revoke the access token and delete that user's stored LinkedIn connection, tokens, synced organization pages, and synced ad accounts.
• Content and analytics: posts published through WrapInbox, campaign records, performance metrics, conversion-event logs, and lead records are part of your workspace data. They are retained to give you historical dashboards and a CRM record until you delete them or your organization's data is deleted under Section 13.
• Erasure requests: you can ask us to delete LinkedIn-derived data, including a specific member's or lead's data, at [email protected]. We will act on verified requests within a reasonable time, subject to information we are legally required to keep.

Revoking WrapInbox's access to LinkedIn

You can withdraw consent at any time, in either of these ways:

• In WrapInbox, open the integrations page and disconnect LinkedIn.
• On LinkedIn, sign in at linkedin.com, go to Settings & Privacy → Data privacy → Permitted services, find WrapInbox Org Management (or Electrobtech LeadAuto, the name shown if you connected through our earlier LinkedIn app), and choose Remove. WrapInbox will then be unable to access your LinkedIn account; to remove the data we have already stored, also disconnect in WrapInbox or contact us as above.

Wrapinbox is operated by Electrobtech Innovations Pvt Ltd (“Company”), reachable at [email protected]. WrapInbox is a multi-tenant platform: each Customer that signs up creates an “organization” (also called a “tenant” or “company workspace”), and data is logically isolated between organizations at the database level.

Account information

When a Customer user is created (during company registration or when invited by an admin), we collect their name, work email address, mobile number, and a hashed password. Users may optionally enable two-factor authentication (via an authenticator app or SMS) and/or set up a numeric PIN as an alternative login method for quicker device sign-in; PINs are stored as a salted hash, expire after a set period, and are locked out after repeated failed attempts. We also store each user’s role (owner, admin, manager, sales, support, or marketing) and availability status (online / away / offline).

Company / organization registration information

During onboarding, an organization owner provides company details used to set up the workspace and, where applicable, to generate GST-compliant invoices:

• Legal and trade name, business type, industry, website, logo, employee count, and description
• Company email, company phone, support email, and alternate phone
• Registered address (address lines, city, state, country, postal code)
• Tax and registration identifiers where relevant to your jurisdiction — GST number, PAN number, company registration number — and, optionally, uploaded copies of incorporation, GST, and registration certificates
• Selected subscription plan and any coupon code applied

If you provide a GST number, we verify it against a third-party GST lookup service (see Section 8) and cache the returned business details (legal/trade name, registration date, status, address) for a limited period to avoid repeated lookups, before re-verifying.

Verification codes

To confirm an email address or mobile number during signup, we generate a one-time code, store a hash of it with an expiry, and send the plain code to you via a transactional email or SMS provider (see Section 8). We do not store the plain-text code after sending it.

WrapInbox is a tool your organization uses to manage information about your own leads and customers (“contacts”). This data is provided or imported by your organization (e.g. via Google Sheets import, manual entry, or automatically as people message your connected channels) — we do not source or sell contact data ourselves. Depending on how your team uses the product, a contact record may include:

• Name, email address, phone number, and company name
• The channel/source the contact came from and their channel-specific identifier (e.g. a WhatsApp number or Instagram-scoped ID)
• Free-text tags, notes, and organization-defined custom fields
• Marketing opt-out status (e.g. after they text STOP/UNSUBSCRIBE)
• CRM data derived from that contact — lead stage, priority, a numeric lead score, deal value, temperature, and course/interest tags your team configures
• Associated e-commerce activity your organization tracks, such as orders and abandoned carts, where that module is in use

Deleting a contact, lead, conversation, or follow-up from the CRM moves it to a “Recently Deleted” state rather than erasing it immediately, so your team can restore it by mistake — see Section 13.

WrapInbox provides a unified inbox across WhatsApp, Instagram, Messenger, SMS, webchat, Google Business Profile reviews/comments, LinkedIn comments, voice calls, and email. Depending on which channels your organization connects, we process:

Uploaded media (images, video, documents used in messages, campaigns, or the marketing asset library) and email attachments are stored either in our database or on service-local storage used by the relevant module. We do not currently route these files through a third-party object-storage provider (e.g. Amazon S3) in this build; if that changes, this Policy will be updated accordingly.

WrapInbox uses AI/large-language-model (LLM) technology to power features such as: drafting and sending automated chatbot/playbook responses across channels, generating marketing and content-studio copy, summarizing and scoring voice calls, classifying support conversations, suggesting sales follow-ups, and retrieval-augmented responses grounded in your organization’s own knowledge base.

To do this, relevant conversation text, call transcripts, contact/lead details, and organization knowledge-base content may be sent as input (“prompts”) to our LLM provider(s):

• Groq — our primary hosted LLM provider, used for AI content generation, agent responses, and call analysis.
• A self-hosted model (Ollama) — used as a fallback generation engine and for generating vector embeddings for knowledge-base search; this runs on infrastructure we control rather than being sent to an external AI vendor.

Knowledge-base embeddings are stored in our Postgres database (using the pgvector extension), scoped to your organization. A lead-scoring model trained on aggregate call and conversation signals is also used to help prioritize leads.

If your organization pays for WrapInbox or for usage-based channel sending (e.g. WhatsApp template messages, SMS), we process:

• Subscription details (plan, billing cycle, amount, currency, status, and renewal dates)
• Payment transaction records processed through our payment gateway, Razorpay — including order/payment identifiers and payment status. We do not store your full card, UPI, or bank account details ourselves; those are handled directly by Razorpay under its own privacy policy.
• An in-app wallet balance and transaction history for usage-based channel billing (recharges, usage deductions, adjustments)
• Tax invoices, which may include your organization’s legal name, GSTIN, billing state, and an itemized breakdown of charges (including applicable GST) where GST invoicing is enabled for your account

A core part of WrapInbox is connecting your own accounts on other platforms. When you connect an integration, that provider shares data with us under the permissions (“scopes”) you grant during their consent screen, and we in turn send certain data to them to operate the connected channel. This is distinct from information you type directly into WrapInbox.

Where we store credentials or tokens for these integrations, sensitive values (such as OAuth refresh tokens) are encrypted at rest when an encryption key is configured for the deployment. You can disconnect any integration from within WrapInbox at any time; doing so revokes our continued access going forward but does not automatically delete data already synced (see Section 13).

Our servers and the underlying hosting/network infrastructure (see Section 16) may generate standard technical logs (such as request timestamps and error logs) in the ordinary course of operating the service. Within the product, we also keep an internal audit log of certain account and administrative actions (who performed an action and when) for security and support purposes.

WrapInbox’s web application authenticates users with a session token stored in your browser’s local storage, not through tracking cookies. As implemented today, the frontend does not load third-party advertising or analytics cookies (such as Google Analytics or similar tools). Our hosting and content-delivery providers may set a small number of strictly necessary technical cookies to operate their infrastructure (e.g. load balancing); these are not used to track you across other websites.

If this changes — for example, if we later add product-analytics or marketing cookies — we will update this section and provide any consent mechanism required by applicable law.

• To provide, operate, and maintain the WrapInbox platform and the specific features/channels your organization has enabled
• To authenticate users, enforce role-based permissions, and secure accounts
• To send, receive, route, and store messages, calls, and emails through your connected channels
• To power AI features (automated responses, summarization, lead scoring, content generation) as described in Section 6
• To process payments, manage subscriptions, and generate invoices
• To provide customer support and respond to inquiries
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To comply with legal obligations, including tax and invoicing requirements
• To communicate service updates, security notices, and (where permitted) product updates

We do not sell personal information. We share information only as follows:

• With the third-party platforms you connect (Meta, Google, LinkedIn, your SMS/voice providers) — to actually send and receive the messages/calls you configure, as described in Section 8.
• With service providers / sub-processors who process data on our behalf under contract, limited to what is needed to provide the service — this currently includes our LLM provider (Groq), payment processor (Razorpay), transactional email provider (Brevo), SMS OTP provider (2Factor.in), GST-verification API provider, voice-calling infrastructure provider (LiveKit and its SIP trunk provider), and our application hosting providers (Section 16).
• Within your organization — data you and your teammates enter is visible to other users in your organization according to their assigned role and permissions.
• For legal reasons — if required to comply with a legal obligation, protect rights and safety, or respond to a valid legal request.
• In a business transfer — if WrapInbox is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to confidentiality commitments consistent with this Policy.

We retain information for as long as your organization’s account is active and as needed to provide the service, plus any additional period required by law (e.g. tax and invoicing records) or for legitimate business purposes (e.g. security, dispute resolution).

Soft delete & “Recently Deleted”

Deleting a contact, lead, conversation, or follow-up in the app does not erase it immediately — it is moved to a “Recently Deleted” area where your team can restore it, and is permanently purged after a limited period, either automatically or via periodic cleanup. Individual messages can similarly be soft-deleted.

Other retention periods observed in the product

• Cached GST verification results are refreshed after roughly 30 days.
• Marketing analytics data has a configurable retention window (defaulting to roughly 90 days in this build) after which it may be aggregated or removed.
• Billing, invoice, and payment records are retained for the period required by applicable tax and accounting law.

Account & organization deletion

To request deletion of your organization’s account and associated data, or deletion of a specific contact’s data, please contact us at [email protected] (see Section 19). Deletion of Google data is also described in the Google user data section above. We will act on verified requests within a reasonable time, subject to information we are legally required or permitted to retain (such as billing/tax records).

We apply a number of technical and organizational safeguards, including:

• Passwords are stored as salted hashes, never in plain text
• Optional two-factor authentication (authenticator app or SMS) and an alternative PIN login with lockout after repeated failed attempts and mandatory periodic renewal
• Session authentication via signed tokens (JWT, signed with HMAC-SHA256)
• Encryption of data in transit using TLS
• Database-level row-level security so one organization’s data is not visible to another
• AES-256-GCM encryption at rest for sensitive third-party credentials, including Google OAuth access and refresh tokens
• Role-based access control limiting what each team member can see and do inside your organization

No method of transmission or storage is 100% secure. While we work to protect information, we cannot guarantee absolute security, and you are responsible for keeping your own account credentials confidential.

Depending on your location and applicable law (such as India’s Digital Personal Data Protection Act, the EU/UK GDPR, or U.S. state privacy laws), you may have rights to access, correct, export, or delete your personal information, restrict or object to certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details in Section 19; where you are a contact/lead of one of our business Customers rather than a Customer user, we will generally direct such requests to the relevant Customer, who controls that data.

Marketing opt-out

End customers can opt out of marketing messages on supported channels (for example, by replying STOP or UNSUBSCRIBE to a WhatsApp or SMS message); we record this opt-out against the contact record so future marketing sends respect it.

WrapInbox’s frontend is hosted on Vercel and its backend services and database are hosted on Railway; our AI features call out to Groq’s API. Depending on the regions your organization and its providers are configured for, information may be processed or stored in a different country than where you or your contacts are located.

WrapInbox is a business tool intended for use by organizations and their staff, not by children. We do not knowingly collect personal information directly from children under 18 for the purpose of creating a WrapInbox account. If you believe a child has provided us with personal information, please contact us so we can address it.

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. We will update the “Last updated” date above and, for material changes, provide additional notice (such as an in-app notification or email) where required by law.

If you have questions about this Privacy Policy or how we handle information, contact us at:

• Company: Electrobtech Innovations Pvt Ltd (Wrapinbox)
• Email: [email protected]
• Website: https://wrapinbox.com · Terms of Service